Hospital and Healthcare Networks: Design and Compliance

A hospital network combines critical requirements rarely found in other environments: 99.999% high availability, medical security for PACS and DICOM, WiFi coverage across all buildings, biomedical IoT such as pumps and monitors, and healthcare GDPR compliance. This guide details a typical architecture for a 200-1000-bed hospital in 2026.

Healthcare-Specific Requirements

• Availability: 99.999% (5 min of downtime/year) for emergency departments and operating rooms
• Compliance: HDS (Health Data Hosting), healthcare GDPR, and ANS (French Digital Health Agency)
• Shared Medical Record (DMP): Sésame-Vitale integration
• HL7 / FHIR: medical data exchange standards
• DICOM: medical imaging (X-ray, MRI, CT scan) — 100 MB-2 GB files
• Multicast is mandatory for certain biomedical devices
• Strict segmentation between IT, biomedical IoT, and patient WiFi

Core Architecture

• 2× Cisco Catalyst 9600 in StackWise Virtual (redundant core)
• Distribution: 2× Catalyst 9500 per building (surgery, medicine, pediatrics)
• Access: Catalyst 9300-48U (UPOE for WiFi 6 APs and 4K cameras)
• Dedicated PACS/DMP data center: Nexus 9300 spine-leaf
• Redundancy: VSS + HSRP + BFD + dual uplinks throughout
• Full-mesh OM4 single-mode fiber between buildings

Hospital WiFi

• 100% coverage: patient rooms, corridors, dining areas, and parking facilities
• 1 AP per 2 rooms or 1 AP per room for critical areas
• Separate SSIDs: OPTINOC-STAFF (WPA3, 802.1X), OPTINOC-BIOMED (isolated PSK), OPTINOC-PATIENTS (WPA3+captive portal), OPTINOC-GUESTS
• Cisco 9166 WiFi 6E for premium rooms and Meraki MR46 for technical rooms
• 802.11k/v/r roaming is mandatory for staff mobile VoIP (DECT over IP, Ascom Myco)

Mandatory Segmentation

• VLAN 10: IT Admin (office LAN)
• VLAN 20: Medical staff (laptops, tablets)
• VLAN 30: DECT/IP telephony
• VLAN 40: PACS medical imaging (dedicated bandwidth)
• VLAN 50-59: Biomedical IoT (pumps, monitors, ventilators) — segmented by department
• VLAN 60: IP security cameras
• VLAN 70: Patient WiFi (internet only)
• VLAN 80: Guest WiFi (isolated)
• VLAN 90: Building automation (air conditioning, lighting)
• VLAN 99: OOB management

Medical Security

• Cisco Cyber Vision or Claroty: biomedical IoT visibility
• FortiGate/Cisco ACI microsegmentation: isolation of each CT scanner/MRI system
• 802.1X NAC (Cisco ISE, ClearPass): every device is inventoried and authorized
• SIEM (Splunk, Microsoft Sentinel): event correlation
• 24×7 SOC with ransomware detection (important: hospitals are the #1 target)

HDS Compliance

• PACS/DMP hosting with an HDS-certified provider (OVH Healthcare, Outscale HDS, AWS HDS)
• Encryption of data at rest and in transit (TLS 1.3)
• Encrypted off-site backups with monthly recovery tests
• Comprehensive logging (minimum 5-year retention)
• Annual HDS/ANS audit

Imaging Redundancy (DICOM)

• PACS storage: 2 replicated SANs (iSCSI or FC)
• MRI transfer (500 MB/acquisition): minimum 1 Gbps
• Long-term archiving: mandatory 20-year retention (LTO tape or HDS cloud)

Budget for a 500-Bed Hospital (Complete Project)

• Core + distribution + access: ~€800,000 excluding tax
• WiFi 6E with 250 APs + controllers: ~€250,000 excluding tax
• Palo Alto PA-3400 firewalls in HA + licenses: ~€150,000 excluding tax
• Cisco ISE NAC: ~€120,000 excluding tax
• SIEM + SOC: ~€60,000 excluding tax/year
• Licenses + 3 years of support: ~€300,000 excluding tax
• Total 3-year project cost: ~€1.5-2M excluding tax

Order from OPTINOC

Turnkey hospital design backed by HDS/ANS expertise. Catalyst 9600 + WiFi 6E + ISE + Cyber Vision. NIS2 and CaRE healthcare compliance. Quotes for 100-1500 beds within 1 week.